P0: tc-auth local sessions, tc-api P0 endpoints, teamclaw-server binary

- tc-auth: argon2id passwords, hashed opaque bearer tokens in auth_sessions (migration 0002), anti-enumeration login errors, redacted token Debug - tc-api: axum router with /healthz, /api/auth/login|logout, /api/user/me, /api/team/{claws,credits,permissions}; Authed bearer extractor + RBAC permission derivation; integration-tested over real TCP vs real Postgres - teamclaw-server: config -> pool -> self-migrate -> serve Co-Authored-By: Claude Fable 5 <[email protected]>
2026-06-09 22:30:33 -05:00
parent 0afb359183
commit c4349bf292
25 changed files with 1257 additions and 0 deletions
@@ -0,0 +1,127 @@
+use tc_auth::{AuthError, AuthService};
+use tc_domain::{Role, User, UserId, Workspace, WorkspaceId};
+
+async fn seeded(pool: &sqlx::PgPool) -> (Workspace, User) {
+    let ws = Workspace {
+        id: WorkspaceId::new(),
+        name: "Acme".into(),
+        plan: "team".into(),
+    };
+    tc_db::repo::workspaces::insert(pool, &ws).await.unwrap();
+    let user = User {
+        id: UserId::new(),
+        workspace_id: ws.id,
+        email: "[email protected]".into(),
+        role: Role::Owner,
+        display_name: "Owner".into(),
+        created_at: time::OffsetDateTime::UNIX_EPOCH,
+    };
+    tc_db::repo::users::insert(pool, &user).await.unwrap();
+    (ws, user)
+}
+
+#[tokio::test]
+async fn register_login_authenticate_round_trip() {
+    let pool = tc_testkit::test_pool().await;
+    let (ws, user) = seeded(&pool).await;
+    let auth = AuthService::new(pool);
+
+    auth.set_password(user.id, "correct horse battery staple")
+        .await
+        .unwrap();
+    let token = auth
+        .login_local("[email protected]", "correct horse battery staple")
+        .await
+        .unwrap();
+
+    let authed = auth.authenticate(token.secret()).await.unwrap();
+    assert_eq!(authed.user_id, user.id);
+    assert_eq!(authed.workspace_id, ws.id);
+    assert_eq!(authed.role, Role::Owner);
+    assert!(authed.role.is_owner());
+}
+
+#[tokio::test]
+async fn wrong_password_is_rejected_without_detail() {
+    let pool = tc_testkit::test_pool().await;
+    let (_, user) = seeded(&pool).await;
+    let auth = AuthService::new(pool);
+    auth.set_password(user.id, "right").await.unwrap();
+
+    let err = auth
+        .login_local("[email protected]", "wrong")
+        .await
+        .unwrap_err();
+    assert!(matches!(err, AuthError::InvalidCredentials));
+}
+
+#[tokio::test]
+async fn unknown_email_is_the_same_error_as_wrong_password() {
+    let pool = tc_testkit::test_pool().await;
+    let auth = AuthService::new(pool);
+    let err = auth.login_local("[email protected]", "pw").await.unwrap_err();
+    // Indistinguishable from a wrong password: no account enumeration.
+    assert!(matches!(err, AuthError::InvalidCredentials));
+}
+
+#[tokio::test]
+async fn user_without_password_cannot_login_locally() {
+    let pool = tc_testkit::test_pool().await;
+    let (_, _user) = seeded(&pool).await;
+    let auth = AuthService::new(pool);
+    let err = auth.login_local("[email protected]", "pw").await.unwrap_err();
+    assert!(matches!(err, AuthError::InvalidCredentials));
+}
+
+#[tokio::test]
+async fn unknown_token_is_unauthenticated() {
+    let pool = tc_testkit::test_pool().await;
+    let auth = AuthService::new(pool);
+    let err = auth.authenticate("not-a-real-token").await.unwrap_err();
+    assert!(matches!(err, AuthError::Unauthenticated));
+}
+
+#[tokio::test]
+async fn expired_session_is_unauthenticated() {
+    let pool = tc_testkit::test_pool().await;
+    let (_, user) = seeded(&pool).await;
+    let auth = AuthService::new(pool.clone());
+    auth.set_password(user.id, "pw").await.unwrap();
+    let token = auth.login_local("[email protected]", "pw").await.unwrap();
+
+    sqlx::query("UPDATE auth_sessions SET expires_at = now() - interval '1 minute'")
+        .execute(&pool)
+        .await
+        .unwrap();
+
+    let err = auth.authenticate(token.secret()).await.unwrap_err();
+    assert!(matches!(err, AuthError::Unauthenticated));
+}
+
+#[tokio::test]
+async fn logout_invalidates_the_token() {
+    let pool = tc_testkit::test_pool().await;
+    let (_, user) = seeded(&pool).await;
+    let auth = AuthService::new(pool);
+    auth.set_password(user.id, "pw").await.unwrap();
+    let token = auth.login_local("[email protected]", "pw").await.unwrap();
+
+    auth.authenticate(token.secret()).await.unwrap();
+    auth.logout(token.secret()).await.unwrap();
+    let err = auth.authenticate(token.secret()).await.unwrap_err();
+    assert!(matches!(err, AuthError::Unauthenticated));
+}
+
+#[tokio::test]
+async fn tokens_are_unique_per_login() {
+    let pool = tc_testkit::test_pool().await;
+    let (_, user) = seeded(&pool).await;
+    let auth = AuthService::new(pool);
+    auth.set_password(user.id, "pw").await.unwrap();
+    let a = auth.login_local("[email protected]", "pw").await.unwrap();
+    let b = auth.login_local("[email protected]", "pw").await.unwrap();
+    assert_ne!(a.secret(), b.secret());
+    // Both remain valid concurrently (multiple devices).
+    auth.authenticate(a.secret()).await.unwrap();
+    auth.authenticate(b.secret()).await.unwrap();
+}